ANSI/ISA-S67.

04-Part I-1994
Approved August 24, 1995

American National Standard

Setpoints for Nuclear

Safety-Related Instrumentation
ANSI/ISA-S67.04, Setpoints for Nuclear Safety-Related Instrumentation, Part I

ISBN: 1-55617-534-5

Copyright  1995 by the Instrument Society of America. All rights reserved. Printed in the United
States of America. No part of this publication may be reproduced, stored in a retrieval system, or
transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or
otherwise), without the prior written permission of the publisher.

ISA
67 Alexander Drive
P.O. Box 12277
Research Triangle Park, North Carolina 27709
Preface

This preface is included for informational purposes and is not part of revised ANSI/ISA-S67.04-
Part I.
This standard has been prepared as part of the service of ISA, the international society for
measurement and control, toward a goal of uniformity in the field of instrumentation. To be of real
value, this document should not be static but should be subject to periodic review. Toward this
end, the Society welcomes all comments and criticisms and asks that they be addressed to the
Secretary, Standards and Practices Board; ISA; 67 Alexander Drive;P.O. Box 12277; Research
Triangle Park, North Carolina 27709; Telephone (919) 549-8411; e-mail: standards@isa.org.
It is the policy of ISA to encourage and welcome the participation of all concerned individuals and
interests in the development of ISA standards, recommended practices, and technical reports.
Participation in the ISA standards-making process by an individual in no way constitutes
endorsement by the employer of the individual, of ISA, or of any of the standards that ISA
develops.
The information contained in the preface, footnotes, and appendices is included for information
only and is not a part of this standard.
Instrument setpoint drift is a problem that has led to numerous abnormal occurrence reports
(now referred to as "Licensee Event Reports"). Section 50.36, "Technical Specifications," of
Code of Federal Regulations, Title 10, Chapter 1, Part 50, Washington, D.C., 1987, requires that,
where a Limiting Safety System Setting (LSSS) is specified for a variable on which a safety limit
has been placed, the setting be so chosen that automatic protective action will correct the most
severe abnormal situation anticipated before a safety limit is exceeded. Inappropriate selection of
a setpoint that does not allow sufficient margin to account for instrument accuracy, the expected
environment, and minor calibration variations can result in calculated drift allowances insufficient
for the instrument used. Protective instruments are provided with setpoints where specific
actions are either initiated, terminated, or prohibited. Setpoints correspond to certain provisions
of Technical Specifications that are incorporated into the facility operation license.
The single most prevalent reason for the drift of a setpoint out of compliance with a technical
specification has been the selection of a setpoint that does not allow a sufficient margin between
the technical specification limit to account for instrument accuracy, the expected environment,
and minor calibration variations. In some cases the setpoint selected was numerically equal to
the technical specification limit and stated as an absolute value, thus leaving no apparent margin
for uncertainties. In other cases, the setpoint was so close to the upper or lower limit of the
instrument's range that instrument drift placed the setpoint beyond the instrument's range thus
nullifying the trip function. Other causes for drift of a setpoint out of conformity with the technical
specifications have been instrumentation design inadequacies and questionable calibration
procedures.
ISA sponsored a review of the setpoint drift problem in April, 1975, by establishing the SP67.4
Subcommittee (now renumbered as S67.04). The Committee's review indicated that a more
thorough consideration of setpoint drift was necessary in the design, test, purchase, installation,
and maintenance of nuclear safety-related instrumentation.
The 1987 revision was made to provide clarification and to reflect current industry practice. The
term "trip setpoint" was made consistent with the terminology used in the NRC Standard
Technical Specifications and reflected what previously was known as "upper setpoint limit."

ANSI/ISA-S67.04-Part I-1994 3
Many of the changes provided in this revision reflect the Improved Technical Specification
program (a cooperative effort between industry and the USNRC). With the issuance of ISA-
RP67.04, Part II, Methodologies for the Determination of Setpoints for Nuclear Safety-Related
Instrumentation, this document will become Part I. Additional changes were made to reflect the
inclusion of the Recommended Practice, Part II to this standard.
This document was developed to specifically address the establishment and maintenance for
individual safety-related instrument channels.
This standard is intended for use primarily by the owners of nuclear power plant facilities or their
agents (nuclear steam system suppliers, architect/engineers, etc.) in establishing procedures for
determining setpoints, setpoint margins, and test routines in safety-related instrument channels.
However, it is equally applicable to large-scale nuclear production reactors.
This standard uses statistical nomenclature, which is customary and familiar to personnel
responsible for nuclear power plant setpoint calculations and instrument uncertainty evaluation.
It should be noted that this nomenclature may have different definitions in other statistical
applications and is not universal, nor is it intended to be. Furthermore, in keeping with the
conservative philosophy employed in nuclear power plant calculations, the combination of
uncertainty methodology for both independent and dependent uncertainty components is
intended to be bounding. That is, the resultant uncertainty should be correct or overly
conservative to insure safe operation. In cases where more precise estimation of measurement
uncertainty is required, more sophisticated techniques should be employed.
Adherence to this standard will not itself suffice to protect the public health and safety because it
is the integrated performance of the structures, the mechanical systems, the fluid systems, the
instrumentation, and the electrical systems of the plant that limit the consequences of design-
basis events. On the other hand, failure to meet these requirements may be an indication of
system inadequacy. Each application for a construction permit or an operating license for a
nuclear power plant is required to develop these items to comply with Title 10, Code of Federal
Regulations, Chapter 1, Part 50. Applicants have the responsibility to assure themselves and
others that this integrated performance is adequate.
ISA Standards Subcommittee SP67.04 operates under SP67, the Nuclear Power Plant
Standards Committee, R. Weigle, Chairman.

The following people served as members of ISA Subcommittees SP67.04 and SP67.15, both of
which collaborated on this revision:

NAME COMPANY

*R. George, SP67.04 Chairman PECO Energy Company

B. Beuchel, SP67.15 Chairman NAESCO/Seabrook Station
M. Widmeyer, Managing Director The Supply System
*T. Hurst, SP67.04 Vice Chairman Hurst Consulting
W. Adams Virginia Electric and Power Company
M. Adler Volian Enterprises
*D. Alexander Detroit Edison Company
*R. Allen ABB Combustion Engineering, Inc.
*J. Alvis ABB Impell International
M. Annon I&C Engineering Associates

*One vote per company

4 ANSI/ISA-S67.04-Part I-1994
 NAME COMPANY

*J. Arpin ABB Combustion Engineering, Inc.

*T. Banek Detroit Edison Company
*B. Basu Southern California Edison
*L. Bates ENSTAT, Inc.
*W. Bejlovec Commonwealth Edison - LaSalle
J. Benjamin Portland Gas & Electric
D. Berryhill Systems Energy Resources
F. Berté Tetra Engineering Group, Inc.
*P. Blanch Consultant
*R. Bockhorst Southern California Edison
*R. Brehm Tennessee Valley Authority
W. Brown ISD Corporation
R. Burnham Consultant
*M. Burns Arizona Public Service
T. Burton INPO
*G. Butera Baltimore Gas & Electric Company
J. Carey, Jr. Salem/Hope Creek Generator Stations
*J. Carolan PECO Energy Company
*J. Cash Control Associates
R. Chan Public Service Electric & Gas
R. Colombo Sacramento Municipal Utility
G. Cooper Commonwealth Edison
*L. Costello Carolina Power & Light Company
W. Cottingham Entergy Operations, Inc.
C. Cristallo, Jr. Northeast Utilities
*W. Croft Westinghouse Electric Corporation
*W. Crumbacker Sargent & Lundy Engineers
J. Das Ebasco Services, Inc.
D. Desai Consolidated Edison of New York, Inc.
T. Donat Vectra
C. Doyel Florida Power Corporation
M. Durr NYPA-IP3
M. Eidson Southern Nuclear Operating Company
N. Eng NUTECH
S. Eschbach B & W Advanced Systems Engineering
*R. Estes Hurst Consulting
R. Fain Analysis & Measurement Services
*J. Festa Northeast Utilities
J. Flaherty Nebraska Public Power District
J. Fougere Proto-Power Engineering
B. Fredricksen New York Power Authority
*V. Fregonese Public Service Electric & Gas Company
*D. Gantt Westinghouse Hanford Company
*S. Ghbein The Supply System
*W. Gordon Bechtel Corporation
*R. Gotcher Weed Instrument Company
*R. Hakeem Entergy Operations, Inc.
*M. Hammer Northern States Power

*One vote per company

ANSI/ISA-S67.04-Part I-1994 5
 NAME COMPANY

B. Haynes Texas Utilities Electric

*J. Hill Northern States Power
W. Hinton North Atlantic Energy Service Corporation
P. Holzman STAR, Inc.
*E. Hubner Stone & Webster, Inc.
*T. Hurst Hurst Engineering Inc.
*J. James Stone & Webster, Inc.
S. Jannetty Public Service Electric & Gas Company
W. Jay Entergy Operations Inc. - Waterford 3
*S. Juravich New York Power Authority
*S. Kincaid Consultant
W. Kramer Bettis Atomic Power Lab
T. Kulaga Ebasco Services, Inc.
*L. Lemons Pacific Gas & Electric Company
*J. Leong General Electric Corporation
P. Loeser U.S. Nuclear Regulatory Commission
*J. Long Bechtel Corporation
K. Lyall Duke Power Company
J. Mauck U.S. Nuclear Regulatory Commission
W. McBride Virginia Power
B. McMillen Nebraska Public Power District
*C. McNall Tenera
*D. McQuade ABB Combustion Engineering, Inc.
*J. McQuighan Baltimore Gas & Electric Company
D. Miller Ohio State University
*J. Mock Bechtel Corporation
U. Mondal Ontario Hydro
R. Morrison TU Electric - CPSES
*R. Naylor Commonwealth Edison
*K. Nesmith Tennessee Valley Authority
R. Neustadter Raytheon Engineers & Constructors, Inc.
J. O'Connell Technicon Enterprises
J. Osborne Florida State & Light Company
L. Patterson Nuclear Plant Engineering
J. Peternel SOR, Inc.
*K Pitilli ABB Impell Corporation
*R. Plotnick Stone & Webster Engineering, Inc.
B. Powell Consultant
R. Profeta S Levy, Inc.
B. Queenan Pacific Nuclear
*E Quinn MDM Engineering
*T. Quigley Northeast Utilities
S. Rabinovich Consultant
*J. Redmon Southern California Edison
*T. Reynolds Weed Instrument Company
D. Ringland The Foxboro Company
S. Roberson Onsite Engineering & Management
*D. Sandlin Gulf States Utilities

*One vote per company

6 ANSI/ISA-S67.04-Part I-1994
 NAME COMPANY

J. Sandstrom Fisher • Rosemount, Inc.

*M. Santic Commonwealth Edison - LaSalle
J. Scheetz Pacific Engineering Corporation
*R. Schimpf New York Power Authority
*E. Schindhelm Westinghouse Electric Corporation
R. Schwartzbeck Enercon Services, Inc.
*J. Shank Public Service Electric & Gas, NJ
*T. Slavic Duquesne Light Company
P. Smith Engineering Planning & Management
C. Sorensen Southern Company Services
W. Sotos American Electric Power Services Corporation
R. Szoch, Jr. Calvert Cliffs Nuclear Plant
B. Sun Electric Power Research Institute
*W. Trenholme I & C Consultant
*C. Tuley Westinghouse Electric Corporation
*K. Utsumi General Electric Corporation
*A. Vakamudi Bechtel Corporation
P. Vande Visse Action Engineering, Inc.
T. Verbout Northern States Power
*J. Voss Tenera, L.P.
*R. Webb Pacific Gas & Electric Company
*R. Weldon Hurst Engineering, Inc.
*S. Weldon Hurst Consulting
*G. Whitmore Duquesne Light Company
*P. Wicyk Commonwealth Edison Company
*R. Wiegle PECO Energy Company
V. Willems Gilbert Commonwealth, Inc.
D. Wilmer General Electric Company
G. Wood Entergy Operations, Inc. - Waterford 3
B. Woodruff Florida Power & Light Company

The following people served as members of ISA Committee SP67:

NAME COMPANY

H. Wiegle, Chairman PECO Energy Company

W. Sotos, Vice Chairman American Electric Power Service Corporation
M. Widmeyer, Managing Director The Supply System
R. Allen ABB Combustion Engineering, Inc.
M. Annon I & C Engineering Associates
B. Basu Southern California Edison Company
J. Bauer General Atomics Company
M. Belew Tennessee Valley Authority
M. Berkovich Bechtel Power Corporation
B. Beuchel NAESCO/ Seabrook Station
P. Blanch Consultant

*One vote per company

ANSI/ISA-S67.04-Part I-1994 7
 NAME COMPANY

*T. Burton INPO

*G. Cooper Commonwealth Edison
N. Dogra Impell Corporation
*A. Ellis Westinghouse Electric Corporation
R. Estes Hurst Engineering
H. Evans Pyco, Inc.
V. Fregonese Public Service Electric & Gas
R. George PECO Energy Company
R. Givan Sargent & Lundy Engineers
*W. Gordon Bechtel Savannah River, Inc.
R. Gotcher Weed Instrument Company
T. Grochowski UNC Engineering Services, Inc.
*S. Hedden Commonwealth Edison Company
*K. Herman Pacific Gas & Electric Company
*R. Hindia Sargent & Lundy Engineers
E. Hubner Stone & Webster
J. Lipka Consultant
*P. Loeser U.S. Nuclear Regulatory Commission
A. Machiels Electric Power Research Institute
*J. Mauck U.S. Nuclear Regulatory Commission
B. McMillen Nebraska Public Power District
*L. McNeil INPO
G. Minor MHB Technical Association
*J. Mock Bechtel Corporation
*J. Nay Westinghouse Electric Corporation
*R. Naylor Commonwealth Edison
R. Neustadter Raytheon Engineers & Constructors, Inc.
R. Phelps Omaha Public Power
R. Profeta S Levy, Inc.
J. Redmon Southern California Edison
F. Semper Semper Engineering
T. Slavic Duquesne Light Company
I. Smith AEA Technology
*I. Sturman Bechtel Corporation
W. Trenholme I & C Consultant
*C. Tuley Westinghouse Electric Corporation
*P. Wicyk Commonwealth Edison Company
K. Utsumi General Electric Corporation
*R. Webb Pacific Gas & Electric Company
G. Whitmore Duquesne Light Company
F. Zikas Parker-Hannifin Corporation

*One vote per company

8 ANSI/ISA-S67.04-Part I-1994
 This standard was approved for publication by the ISA Standards and Practices Board in
September, 1994.

NAME COMPANY

W. Weidman, Vice President Gilbert Commonwealth, Inc.

H. Baumann H. D. Baumann & Associates, Ltd.
D. Bishop Chevron USA Production Company
W. Calder III Foxboro Company
C. Gross Dow Chemical Company
H. Hopkins Utility Products of Arizona
A. Iverson Lyondell Petrochemical Company
K. Lindner Endress + Hauser GmbH + Company
T. McAvinew Metro Wastewater Reclamation District
A. McCauley, Jr. Chagrin Valley Controls, Inc.
G. McFarland ABB Power Plant Controls
J. Mock Bechtel
E. Montgomery Fluor Daniel, Inc.
D. Rapley Rapley Engineering Services
R. Reimer Allen-Bradley Company
R. Webb Pacific Gas & Electric Company
J. Weiss Electric Power Research Institute
J. Whetstone National Institute of Standards & Technology
M. Widmeyer The Supply System
C. Williams Eastman Kodak Company
G. Wood Graeme Wood Consulting
M. Zielinski Fisher • Rosemount

ANSI/ISA-S67.04-Part I-1994 9
 Contents

1 Purpose ................................................................................................................................. 13

2 Scope .................................................................................................................................... 13

3 Definitions ............................................................................................................................ 14

4 Establishment of setpoints ................................................................................................. 15

4.1 Safety ......................................................................................................................... 16
4.2 Safety analysis ........................................................................................................... 16
4.3 Limiting safety system setting (LSSS) ........................................................................ 16
4.4 Combination of uncertainties ...................................................................................... 19

5 Documentation ..................................................................................................................... 19

6 Maintenance of safety-related setpoints ........................................................................... 20

6.1 Testing ........................................................................................................................ 20
6.2 Replacement .............................................................................................................. 21

7 References ............................................................................................................................ 23

8 Informative references ........................................................................................................ 24

Figure
1 — Nuclear safety-related setpoint relationships ..................................................................... 25

ANSI/ISA-S67.04-Part I-1994 11
1 Purpose

The purpose of the standard is to develop a basis for establishing setpoints for nuclear safety-
related instrumentation (as defined in Section 3). This standard addresses known contributing
errors in the channel from the process (including the primary element and sensor) through and
including the final setpoint device.

2 Scope

This standard defines the requirements for assuring that setpoints for nuclear safety-related
instrumentation (as defined in Section 3), are established and maintained within specified limits
in nuclear power plants and nuclear reactor facilities.
Part II of this standard is a recommended practice that provides guidance for the implementation
of Part I. This guidance is in the following areas:

a) Methodologies, including sample equations, to calculate total channel uncertainty

b) Common assumptions and practices in instrument uncertainty calculations
c) Equations for estimating uncertainties for commonly used analog and digital modules
d) Methodologies to determine the impact of commonly encountered effects on instrument
uncertainty
e) Application of instrument channel uncertainty in setpoint determination
f) Sources and interpretation of data for uncertainty calculations
g) Discussion of the interface between setpoint determination and plant-operating
procedures, calibration procedures, and accident analysis
h) Documentation requirements

ANSI/ISA-S67.04-Part I-1994 13
3 Definitions

3.1 allowable value: A limiting value that the trip setpoint may have when tested periodically,
beyond which appropriate action shall be taken.

3.2 analytical limit: Limit of a measured or calculated variable established by the safety analysis
to ensure that a safety limit is not exceeded.

3.3 as found: The condition in which a channel, or portion of a channel, is found after a period
of operation and before recalibration (if necessary).

3.4 as left: The condition in which a channel, or portion of a channel, is left after calibration or
final setpoint device setpoint verification.

3.5 design basis: The design basis for protection systems is as defined in Part 4, Safety System
Design Basis, of IEEE Standard 603-1980. (See IEEE, Std. 603.)

3.6 drift: An undesired change in output over a period of time where change is unrelated to the
input, environment, or load. (See ANSI/ISA-S51.1.)

3.7 error: The algebraic difference between the indication and the ideal value of the measured
signal. (See ANSI/ISA-S51.1.)

3.8 final setpoint device: A component, or assembly of components, that provides input to the
process voting logic for actuated equipment.
NOTE — Examples of final setpoint devices are bistables, relays, pressure switches, and
level switches.

3.9 foldover: A device characteristic exhibited when a further change in the input produces an
output signal that reverses its direction from the specified input-output relationship.

3.10 instrument channel: An arrangement of components and modules as required to generate

a single protective action signal when required by a plant condition. A channel loses its identity
where single protective action signals are combined. (See IEEE, Std. 603.)

3.11 instrument range: The region between the limits within which a quantity is measured,
received, or transmitted and is expressed by stating the lower and upper range values. (See ANSI/
ISA-S51.1.)

3.12 limiting safety system setting (LSSS): Limiting safety system settings for nuclear reactors
are settings for automatic protective devices related to those variables having significant safety
functions. [See CFR, 50.36(c)(1)(i)(A).]

3.13 nuclear safety-related instrumentation: That which is essential to the following:

a) Provide emergency reactor shutdown

b) Provide containment isolation
c) Provide reactor core cooling
d) Provide for containment or reactor heat removal
e) Prevent or mitigate a significant release of radioactive material to the environment

14 ANSI/ISA-S67.04-Part I-1994
or is otherwise essential to provide reasonable assurance that a nuclear power plant can be
operated without undue risk to the health and safety of the public.

3.14 primary element: The system element that quantitatively converts the measured variable
energy into a form suitable for measurement. (See ANSI/ISA-S51.1.)

3.15 reference accuracy (also known as Accuracy Rating as defined in S51.1): A number
or quantity that defines a limit that errors will not exceed when a device is used under specified
operating conditions. (See ANSI/ISA-S51.1.)

3.16 safety limit: A limit on an important process variable that is necessary to reasonably protect
the integrity of physical barriers that guard against the uncontrolled release of radioactivity. [See
CFR, 50.36(c)(1)(i)(A).]

3.17 saturation: A device characteristic exhibited when a further change in the input signal
produces no additional change in the output.

3.18 sensor: The portion of a channel that responds to changes in a plant variable or condition
and converts the measured process variable into a signal, e.g., electric or pneumatic. (See IEEE,
Std 603.)

3.19 test interval: The elapsed time between the initiation (or successful completion) of tests
on the same sensor, channel, load group, safety group, safety system, or other specified system
or device. (See ANSI/IEEE, Std. 338.)

3.20 trip setpoint: A predetermined value for actuation of the final setpoint device to initiate a
protective action.

3.21 uncertainty: The amount to which an instrument channel's output is in doubt (or the allowance
made therefore) due to possible errors, either random or systematic, that have not been corrected.
The uncertainty is generally identified within a probability and confidence level.
Additional definitions related to instrumentation terminology and uncertainty may be found in
ANSI/ISA-S51.1-1979 and ANSI/ISA-S37.1-1969.

4 Establishment of setpoints

Trip setpoints in nuclear safety-related instruments shall be selected to provide sufficient

allowance between the trip setpoint and the safety limit to account for uncertainties. Detailed
requirements for safety-related instrument setpoint relationships are given in the following
sections, as illustrated in Figure 1.
The importance of the various types of safety-related setpoints differ, and as such it may be
appropriate to apply different setpoint determination requirements. For automatic setpoints that
have a significant importance to safety, for example, those required by the plant safety analyses
and directly related to Reactor Protection System, Emergency Core-Cooling Systems,
Containment Isolation, and Containment Heat Removal, a stringent setpoint methodology should
consider all of the items noted in 4.1 - 4.4.2. However, for setpoints that may not have the same
level of stringent requirements, for example, those that are not credited in the safety analyses or
that do not have limiting values, the setpoint determination methodology could be less rigorous.

ANSI/ISA-S67.04-Part I-1994 15
In general, all uncertainty terms for a particular setpoint methodology may not be required for all
setpoint calculations. The methodologies utilized shall be documented and appropriate
justification shall be provided.

4.1 Safety

Physical barriers are designed to prevent the uncontrolled release of radioactivity. Safety limits
are chosen to maintain the integrity of these physical barriers. For this standard, design limits for
engineered safety features are treated the same as safety limits. Safety limits can be defined in
terms of directly measured process variables such as pressure or temperature. Safety limits can
also be defined in terms of a calculated variable involving two or more measured process
variables. An example of a calculated variable is the departure from nucleate boiling ratio.

4.2 Safety analysis

The safety analysis establishes (1) an analytical limit in terms of a measured or calculated
variable and (2) a specific time after that value is reached to begin protective action. Satisfying
these two constraints will ensure that the safety limit of Section 4.1 will not be exceeded during
anticipated operational occurrences and design-basis events.

4.3 Limiting safety system setting (LSSS)

The purpose of an LSSS is to assure that protective action is initiated before the process
conditions reach the analytical limit, thereby limiting the consequences of a design-basis event to
those predicted by the safety analyses. The LSSS is derived from the analytical limit in a manner
determined by the setpoint calculation methodology. Depending on the methodology, the LSSS
may be the allowable value, the trip setpoint, or both. The LSSS is maintained by either the
technical specifications or the plant-operating procedures. Figure 1 illustrates the relationships
between an analytical limit and an LSSS. Detailed requirements for developing trip setpoints and
allowable values are given in 4.3.1 - 4.4.2.

4.3.1 Trip setpoint

The trip setpoint should be the value that the final setpoint device is set to actuate. Data used to
select the trip setpoint may be taken from any of the following sources: operating experience,
equipment qualification tests, vendor design specifications, engineering analysis, laboratory
tests, and engineering drawings.
An allowance shall be provided between the trip setpoint and the analytical limit to ensure a trip
before the analytical limit is reached. The allowance used shall account for all applicable design-
basis events and the following process instrument uncertainties unless they were included in the
determination of the analytical limit. Figure 1 illustrates the relationships between the trip
setpoint and other parameters. Region A represents the uncertainties allowed between the
analytical limit and the trip setpoint. Region B denotes the difference between the allowable
value and the trip setpoint. Region D illustrates the difference between the expected value of the
process variable during normal operation and the trip setpoint. Region E notes an allowance for
calibration tolerance about the trip setpoint.

16 ANSI/ISA-S67.04-Part I-1994
The following uncertainties are not all-inclusive:
(Additional uncertainties that may apply to a particular instrument channel shall be accounted for
in determining the trip setpoint allowance. Not all of the uncertainties listed apply to every
measurement channel.)
a) Instrument calibration uncertainties caused by the
1) calibration standard;
2) calibration equipment; or
3) calibration method.
b) Instrument uncertainties during normal operation caused by
1) reference accuracy, including:*
(a) conformity (linearity);
(b) hysteresis;
(c) dead band; and
(d) repeatability.
2) power supply voltage changes;
3) power supply frequency changes;
4) temperature changes;
5) humidity changes;
6) pressure changes;
7) vibration (inservice);
8) radiation exposure;
9) analog-to-digital (A-D) conversion; and
10) digital-to-analog (D-A) conversion.
c) Instrument drift
All instruments may not have the same calibration interval. The drift used shall be based
on instrument-specific calibration intervals.
d) Instrument uncertainties caused by design-basis events
Only uncertainties specific to the event and required period of service should be used. The
use of different uncertainty components for the same process equipment for different
events is permitted. Any residual effects of a design-basis event shall also be included.
The following are examples of these effects (but are not limited to them):
1) Temperature effects
The uncertainties associated with event-specific temperature profiles shall be used
where possible. If these are not available, use the uncertainty associated with a limiting
temperature.

*Definitions of these terms are provided in ANSI/ISA-S51.1-1979, Process Instrumentation Terminology.

ANSI/ISA-S67.04-Part I-1994 17
 2) Radiation effects
The uncertainties associated with event-specific radiation exposure shall be used
where possible. If these are not available, use the uncertainty associated with a limiting
radiation exposure (including Total Integrated Dose and rate effects).
3) Seismic/vibratory effects
The uncertainties associated with a safe shutdown or operating basis earthquake shall
be used, as appropriate.
e) Process-dependent effects
The determination of the trip setpoint allowance shall account for uncertainties associated
with the process variable. Examples are (but are not limited to) the effect of fluid stratifi-
cation on temperature measurement, the effect of changing fluid density on level measure-
ments, and process oscillations or noise.
f) Calculation effects
The determination of the trip setpoint allowance shall account for uncertainties resulting
from the use of a mathematical model to calculate a variable from measured process vari-
ables. An example is (but is not limited to) the determination of primary side power via the
secondary side power calorimetric.
g) Dynamic effects
The behavior of a channel's output as a function of the input with respect to time shall be
accounted for, either in the determination of the trip setpoint or included in the safety anal-
yses. Normally, these effects are accounted for in the safety analyses.
h) Calibration and installation bias accounting
Any bias of fixed magnitude and known direction due to equipment installation or calibra-
tion method shall be either eliminated during calibration or accounted for in the setpoint
calculation.

4.3.2 Allowable value

The purpose of the allowable value is to identify a value that, if exceeded, may mean that the
instrument has not performed within the assumptions of the setpoint calculation. A channel
whose trip setpoint as-found condition exceeds the allowable value should be evaluated for
operability, taking into account the setpoint calculation methodology. The uncertainties included
in the allowance between the allowable value and the trip setpoint (see Region B of Figure 1) are
a function of the portion of the instrument channel being tested and the setpoint calculation
methodology. These uncertainties may include the following:

a) Instrument calibration uncertainties [4.3.1 (a)]

b) Instrument uncertainties during normal operation [4.3.1 (b)]
c) Instrument drift [4.3.1 (c)]

The assumptions, data, and methods used to determine the allowable value shall be documented
and consistent with those used to determine the trip setpoint. The determination of an allowable
value is only applicable to setpoints subjected to periodic surveillance requirements specified by
the plant's licensing basis.

18 ANSI/ISA-S67.04-Part I-1994
4.4 Combination of uncertainties

The following methods are acceptable for combining uncertainties: square-root-sum-of-squares

(SRSS) and algebraic. Alternate methods, including probabilistic or stochastic modeling, or a
combination of SRSS and algebraic methods may also be used.

4.4.1 Square-root-sum-of-squares method (SRSS)

It is acceptable to combine uncertainties that are random, normally distributed, and independent
by the SRSS method. When two independent uncertainties, (± a) and (± b), are combined by
this method, the resulting uncertainty is (± c), where c = (a² + b²)½.

4.4.2 Algebraic method

It is acceptable to combine uncertainties that are not random, not normally distributed, or are
dependent by the algebraic method. In this method, the combination of two dependent
uncertainties, (+a, -0) and (+0, -b), results in a third uncertainty distribution with limits
(+a, -b).

5 Documentation

The various aspects of the uncertainty calculation, (e.g., instrument uncertainties, process
effects, calculation methods, data sources, and assumptions) shall be documented.
a) The method(s) by which setpoints are calculated shall be documented. The
documentation may include, as appropriate, the following:
1) The relationship between the analytical limit, the allowable value, the setpoint, the
as-found limit, and the as-left limit
2) The uncertainty terms that are addressed
3) The method used to combine uncertainty terms
4) Justification of statistical combination methods (other than SRSS or algebraic
combination).
b) The setpoint calculations shall be documented. The documentation may include, as
appropriate, the following:
1) A description of the instrument channel, including the manufacturer and model
number of all devices that contribute to the channel uncertainty
2) The relationship between instrument and process measurement units
3) The safety limit
4) The basis for selection of the trip setpoint
5) Data used to select the trip setpoint, including the source of the data
6) Assumptions used to select the trip setpoint, e.g., ambient temperature limits for
equipment calibration and operation

ANSI/ISA-S67.04-Part I-1994 19
 7) Known installation and calibration bias values that could affect the setpoint
8) Correction factors used to determine the setpoint, e.g., pressure compensation to
account for elevation difference between the trip measurement point and the sensor
physical location.
c) Instrument test data shall be documented. The documentation may include as-left data
and as-found data.

6 Maintenance of safety-related setpoints

The following sections address those aspects of safety-related instrument setpoint maintenance
necessary to support the trip setpoints as described in Section 4. Information in this section is
supplemental to other industry standards that give guidance in maintenance of safety-related
setpoints. (See Section 8.)

6.1 Testing

Periodic channel tests shall be performed at an appropriate test interval to ensure that the
instrument channel is functioning in compliance with the safety analysis and to verify that trip
setpoints remain within their established limits during operation. Formal documentation is
necessary to support the investigation and documentation of any occurrence where a limit is
exceeded, in the high or low direction as applicable. This verification shall be achieved by
recording sufficient as-found data to determine the setpoint in terms of the measured or derived
process variables, prior to any adjustment. As-found data shall be the data taken during the first
traverse in the direction of concern during the test.
If as-found data indicates that no instrument adjustment is necessary, documentation of the
testing and as-found data is all that is required. If there is a need for adjustment, documentation
of the as-found and as-left data is required.
If as-found data indicates that an allowable value was exceeded, appropriate action shall be
taken. This action shall include investigation to determine the cause of the finding, evaluation of
operability, and appropriate corrective action to prevent a re-occurrence. Possible corrective
actions for consideration are
a) adjustment of testing frequency;
b) setpoint revision (in the conservative direction);
c) reevaluation of the trip setpoint or allowable value (as applicable);
d) evaluation of equipment installation and environment;
e) evaluation of calibration (equipment and technique); or
f) repair or replacement of the device.

20 ANSI/ISA-S67.04-Part I-1994
6.2 Replacement

The performance of replacement materials, parts, and components shall be evaluated with
respect to instrument uncertainties and the continued validity of the trip setpoint.

ANSI/ISA-S67.04-Part I-1994 21
7 References

INSTITUTE OF ELECTRICAL AND ELECTRONIC ENGINEERS (IEEE)

Standard 338 Standard Criteria for the Periodic Testing of Nuclear Power
Generating Station Class 1E Power and Production Systems
Standard 603 Standard Criteria for Safety Systems for Nuclear Power
Generating Stations
Available from: Institute of Electrical and Electronic Engineers
345 East 47th Street
New York, NY 10017 Tel: (800) 678-4333

ISA

ANSI/ISA-S51.1 Process Instrumentation Terminology, pgs. 18 and 25.

Available from: ISA
67 Alexander Drive
P.O. Box 12277
Research Triangle Park, NC 27709 Tel: (919) 549-8411

UNITED STATES CODE OF FEDERAL REGULATIONS (CFR)

Title 10
Part 50 Paragraphs 50.36(c)(1)(i)(A) and 50.36(c)(1)(ii)(A)
Available from: Superintendent of Documents
U.S. Government Printing Office
Washington, D.C. 20402

ANSI/ISA-S67.04-Part I-1994 23
8 Informative references

ISA has developed standards for the nuclear industry through SP67, Nuclear Power Plant
Standards Committee (NPPSC). ISA and other standards of possible interest to the reader are
listed below.

AMERICAN NATIONAL STANDARDS INSTITUTE (ANSI)

ANSI/ASME NQA-1 Quality Assurance Program Requirements for Nuclear Facilities

Available from: ANSI
11 West 42nd Street
New York, NY 10036 Tel: (212) 642-4900

INSTITUTE OF ELECTRICAL AND ELECTRONIC ENGINEERS (IEEE)

Standard 352 Guide for General Principles of Reliability Analysis of Nuclear

Power Generating Station Protection Systems
Standard 498 Standard Requirements for the Calibration and Control of
Measuring and Test Equipment Used in the Calibration and
Maintenance of Nuclear Power Generating Stations
Available from: IEEE
345 East 47th Street
New York, NY 10017 Tel: (800) 678-4333

ISA — THE INTERNATIONAL SOCIETY FOR MEASUREMENT AND CONTROL

ANSI/ISA-S67.02 Nuclear-Safety-Related Instrument Sensing Line Piping and

Tubing Standards for Use in Nuclear Power Plants
ANSI/ISA-S67.01 Transducer and Transmitter Installation for Nuclear Safety
Applications
Available from: ISA
67 Alexander Drive
P.O. Box 12277
Research Triangle Park, NC 27709 Tel: (919) 549-8411

24 ANSI/ISA-S67.04-Part I-1994
 SAFETY LIMIT

ANALYTICAL LIMIT

NOTE: THIS FIGURE IS INTENDED

TO PROVIDE RELATIVE
POSITION AND NOT TO
IMPLY DIRECTION

C
ALLOWABLE
VALUE
(LSSS)

TRIP
E SETPOINT
(LSSS)

NORMAL

A. ALLOWANCE DESCRIBED IN PARAGRAPH 4.3.1

B. ALLOWANCE DESCRIBED IN PARAGRAPH 4.3.2
C. REGION WHERE CHANNEL MAY BE DETERMINED INOPERABLE
D. PLANT OPERATING MARGIN
E. REGION OF CALIBRATION TOLERANCE (ACCEPTABLE AS LEFT CONDITION)
DESCRIBED IN PARAGRAPH 4.3.1

Figure 1 — Nuclear safety-related setpoint relationships

ANSI/ISA-S67.04-Part I-1994 25
Developing and promulgating technically sound consensus standards,
recommended practices, and technical reports is one of ISA's primary
goals. To achieve this goal the Standards and Practices Department
relies on the technical expertise and efforts of volunteer committee
members, chairmen, and reviewers.
ISA is an American National Standards Institute (ANSI) accredited
organization. ISA administers United States Technical Advisory
Groups (USTAGs) and provides secretariat support for International
Electrotechnical Commission (IEC) and International Organization for
Standardization (ISO) committees that develop process measurement
and control standards. To obtain additional information on the
Society's standards program, please write:

ISA
Attn: Standards Department
67 Alexander Drive
P.O. Box 12277
Research Triangle Park, NC 27709

ISBN: 1-55617-534-5